3x-ui

mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-27 20:26:42 +08:00

Files

T

Kirill Rudenko 788b76c544 fix(amneziawg): sniff the relay with routeOnly; scope the v6 egress to IPv6 (#6654 )

* fix(amneziawg): sniff the relay with routeOnly

The embedded AmneziaWG relay sniffed without routeOnly, so a sniffed SNI
replaced the dial target. Telegram's FakeTLS recovery dials
194.221.250.50:443 with SNI www.google.com; the rewrite sent it to real
Google and the client looped on "TLS hash mismatch", stuck on "Connecting".

Sniffing here exists only so domain routing rules can match; routeOnly
keeps that and dials the IP the peer resolved. Fake-pool targets are
still rewritten (the dispatcher ignores routeOnly for fakedns).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(amneziawg): send only IPv6 targets through the peer's v6 egress

The per-peer IPv6 egress rule matched every flow of that peer, but its
freedom outbound binds a v6 sendThrough and cannot dial an IPv4 target, so
IPv4 DNS and any other unsniffed IPv4 traffic of such a peer failed.
Sniffed TLS/HTTP only worked because the sniffed domain replaced the IP;
with routeOnly on the relay that no longer happens.

Limiting the rule to ::/0 keeps the peer's IPv6 identity for IPv6 targets
and lets IPv4 targets take the regular outbound.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Kirill Rudenko <rudenko@npp-energy.ru>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>

2026-09-26 22:04:08 +02:00

controller

fix(sub): never use X-Real-IP as the subscription host (#6608 )

2026-09-26 21:13:46 +02:00

entity

fix(sub): make Happ require auth on its local SOCKS/HTTP proxy (#6628 )

2026-09-26 22:03:20 +02:00

global

…

job

fix(ip-limit): CAS-retry inbound_client_ips merges under Postgres (#6612 )

2026-09-26 22:00:40 +02:00